422 lines
14 KiB
Python
422 lines
14 KiB
Python
# authentic2 - versatile identity manager
|
|
# Copyright (C) 2010-2019 Entr'ouvert
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
import json
|
|
import uuid
|
|
from functools import wraps
|
|
|
|
from django.contrib.contenttypes.models import ContentType
|
|
from django.core.exceptions import NON_FIELD_ERRORS, ValidationError
|
|
from django.core.validators import validate_slug
|
|
from django.utils.text import format_lazy
|
|
from django.utils.translation import gettext_lazy as _
|
|
|
|
from authentic2.a2_rbac.models import Operation, OrganizationalUnit, Permission, Role, RoleParenting
|
|
from authentic2.a2_rbac.utils import get_default_ou
|
|
from authentic2.decorators import errorcollector
|
|
from authentic2.utils.lazy import lazy_join
|
|
|
|
|
|
def update_model(obj, d):
|
|
for attr, value in d.items():
|
|
setattr(obj, attr, value)
|
|
errors = {}
|
|
with errorcollector(errors):
|
|
if hasattr(obj, 'validate'):
|
|
obj.validate()
|
|
|
|
with errorcollector(errors):
|
|
if hasattr(obj, 'validate_unique'):
|
|
obj.validate_unique()
|
|
if errors:
|
|
errorlist = []
|
|
for key, messages in list(errors.items()):
|
|
if key == NON_FIELD_ERRORS:
|
|
errorlist.extend(messages)
|
|
else:
|
|
value = getattr(obj, key)
|
|
|
|
def error_list(messages):
|
|
for message in messages:
|
|
if isinstance(message, ValidationError):
|
|
yield message.message
|
|
else:
|
|
yield message
|
|
|
|
for message in error_list(messages):
|
|
errorlist.append(
|
|
format_lazy(
|
|
'{}="{}": {}', obj.__class__._meta.get_field(key).verbose_name, value, message
|
|
)
|
|
)
|
|
raise ValidationError(errorlist)
|
|
obj.save()
|
|
|
|
|
|
class ExportContext:
|
|
_role_qs = None
|
|
_ou_qs = None
|
|
export_roles = None
|
|
export_ous = None
|
|
|
|
def __init__(self, role_qs=None, ou_qs=None, export_roles=True, export_ous=True):
|
|
self._role_qs = role_qs
|
|
self._ou_qs = ou_qs
|
|
self.export_roles = export_roles
|
|
self.export_ous = export_ous
|
|
|
|
@property
|
|
def role_qs(self):
|
|
return self._role_qs or Role.objects.all()
|
|
|
|
@property
|
|
def ou_qs(self):
|
|
return self._ou_qs or OrganizationalUnit.objects.all()
|
|
|
|
|
|
def export_site(context=None):
|
|
context = context or ExportContext()
|
|
d = {}
|
|
if context.export_roles:
|
|
d['roles'] = export_roles(context)
|
|
if context.export_ous:
|
|
d['ous'] = export_ous(context)
|
|
return d
|
|
|
|
|
|
def export_ous(context):
|
|
return [ou.export_json() for ou in context.ou_qs]
|
|
|
|
|
|
def export_roles(context):
|
|
"""Serialize roles in role_queryset"""
|
|
return [role.export_json(parents=True, permissions=True) for role in context.role_qs]
|
|
|
|
|
|
def search_ou(ou_d):
|
|
try:
|
|
OU = OrganizationalUnit
|
|
return OU.objects.get_by_natural_key_json(ou_d)
|
|
except OU.DoesNotExist:
|
|
return None
|
|
|
|
|
|
def search_role(role_d, ou=None):
|
|
try:
|
|
role = Role.objects.get_by_natural_key_json(role_d)
|
|
except Role.DoesNotExist:
|
|
return None
|
|
else:
|
|
if ou and role.ou != ou:
|
|
# Allow creation of the role in a different OU
|
|
role_d.pop('uuid')
|
|
return None
|
|
return role
|
|
|
|
|
|
class ImportContext:
|
|
"""Holds information on how to perform the import.
|
|
|
|
ou_delete_orphans: if True any existing ou that is not found in the export will
|
|
be deleted
|
|
|
|
role_delete_orphans: if True any existing role that is not found in the export will
|
|
be deleted
|
|
|
|
|
|
role_attributes_update: legacy, for each role in the import data,
|
|
attributes will deleted and re-created
|
|
|
|
|
|
role_parentings_update: for each role in the import data,
|
|
parentings will deleted and re-created
|
|
|
|
role_permissions_update: for each role in the import data,
|
|
permissions will deleted and re-created
|
|
"""
|
|
|
|
def __init__(
|
|
self,
|
|
import_roles=True,
|
|
import_ous=True,
|
|
role_delete_orphans=False,
|
|
role_parentings_update=True,
|
|
role_permissions_update=True,
|
|
role_attributes_update=True,
|
|
ou_delete_orphans=False,
|
|
set_ou=None,
|
|
allowed_ous=None,
|
|
set_absent_ou_to_default=None,
|
|
):
|
|
self.import_roles = import_roles
|
|
self.import_ous = import_ous
|
|
self.role_delete_orphans = role_delete_orphans
|
|
self.ou_delete_orphans = ou_delete_orphans
|
|
self.role_parentings_update = role_parentings_update
|
|
self.role_permissions_update = role_permissions_update
|
|
self.role_attributes_update = role_attributes_update
|
|
self.set_ou = set_ou
|
|
self.allowed_ous = allowed_ous
|
|
self.set_absent_ou_to_default = set_absent_ou_to_default
|
|
|
|
|
|
def wraps_validationerror(func):
|
|
@wraps(func)
|
|
def f(self, *args, **kwargs):
|
|
try:
|
|
return func(self, *args, **kwargs)
|
|
except ValidationError as e:
|
|
raise ValidationError(
|
|
_('Role "%(name)s": %(errors)s')
|
|
% {
|
|
'name': self._role_d.get('name', self._role_d.get('slug')),
|
|
'errors': lazy_join(', ', [v.message for v in e.error_list]),
|
|
}
|
|
)
|
|
|
|
return f
|
|
|
|
|
|
class RoleDeserializer:
|
|
def __init__(self, d, import_context):
|
|
self._import_context = import_context
|
|
self._obj = None
|
|
self._parents = None
|
|
self._attributes = None
|
|
self._permissions = None
|
|
|
|
self._role_d = {}
|
|
for key, value in d.items():
|
|
if key == 'parents':
|
|
self._parents = value
|
|
elif key == 'attributes':
|
|
self._attributes = value
|
|
elif key == 'permissions':
|
|
self._permissions = value
|
|
else:
|
|
self._role_d[key] = value
|
|
|
|
@wraps_validationerror
|
|
def deserialize(self):
|
|
if self._import_context.set_ou:
|
|
ou = self._import_context.set_ou
|
|
elif 'ou' in self._role_d:
|
|
ou_d = self._role_d['ou']
|
|
has_ou = bool(ou_d)
|
|
ou = None if not has_ou else search_ou(ou_d)
|
|
if has_ou and not ou:
|
|
raise ValidationError(_("Can't import role because missing Organizational Unit: %s") % ou_d)
|
|
if self._import_context.allowed_ous and ou not in self._import_context.allowed_ous:
|
|
raise ValidationError(
|
|
_("Can't import role because missing permissions on Organizational Unit: %s") % ou_d
|
|
)
|
|
elif self._import_context.set_absent_ou_to_default:
|
|
ou = get_default_ou()
|
|
else:
|
|
name = self._role_d.get('name') or self._role_d.get('slug') or self._role_d.get('uuid')
|
|
raise ValidationError(_("Missing Organizational Unit for role: %s") % name)
|
|
|
|
obj = search_role(self._role_d, ou=self._import_context.set_ou)
|
|
|
|
kwargs = self._role_d.copy()
|
|
kwargs['ou'] = ou
|
|
kwargs.pop('service', None)
|
|
|
|
if 'uuid' in kwargs:
|
|
if not isinstance(kwargs['uuid'], str):
|
|
raise ValidationError(_("Cannot import role '%s' with invalid uuid") % kwargs.get('name'))
|
|
try:
|
|
uuid.UUID(kwargs['uuid'])
|
|
except ValueError:
|
|
raise ValidationError(_("Cannot import role '%s' with invalid uuid") % kwargs.get('name'))
|
|
|
|
if 'slug' in kwargs:
|
|
if not isinstance(kwargs['slug'], str):
|
|
raise ValidationError(_("Cannot import role '%s' with invalid slug") % kwargs.get('name'))
|
|
try:
|
|
validate_slug(kwargs['slug'])
|
|
except ValidationError:
|
|
raise ValidationError(_("Cannot import role '%s' with invalid slug") % kwargs.get('name'))
|
|
|
|
if obj: # Role already exist
|
|
self._obj = obj
|
|
status = 'updated'
|
|
update_model(self._obj, kwargs)
|
|
else: # Create role
|
|
if 'uuid' in kwargs and not kwargs['uuid']:
|
|
raise ValidationError(_("Cannot import role '%s' with empty uuid") % kwargs.get('name'))
|
|
self._obj = Role.objects.create(**kwargs)
|
|
status = 'created'
|
|
|
|
# Ensure admin role is created.
|
|
# Absoluteley necessary to create
|
|
# parentings relationship later on,
|
|
# since we don't deserialize technical role.
|
|
self._obj.get_admin_role()
|
|
return self._obj, status
|
|
|
|
@wraps_validationerror
|
|
def attributes(self):
|
|
"""Compatibility with old import files, set Role fields using attributes data"""
|
|
created, deleted = [], []
|
|
# Create attributes
|
|
if self._attributes:
|
|
for attr_dict in self._attributes:
|
|
setattr(self._obj, attr_dict['name'], json.loads(attr_dict['value']))
|
|
|
|
return created, deleted
|
|
|
|
@wraps_validationerror
|
|
def parentings(self):
|
|
"""Update parentings (delete everything then create)"""
|
|
created, deleted = [], []
|
|
for parenting in RoleParenting.objects.filter(child=self._obj, direct=True):
|
|
parenting.delete()
|
|
deleted.append(parenting)
|
|
|
|
if self._parents:
|
|
for parent_d in self._parents:
|
|
parent = search_role(parent_d)
|
|
if not parent:
|
|
raise ValidationError(_("Could not find parent role: %s") % parent_d)
|
|
created.append(RoleParenting.objects.create(child=self._obj, direct=True, parent=parent))
|
|
|
|
return created, deleted
|
|
|
|
@wraps_validationerror
|
|
def permissions(self):
|
|
"""Update permissions (delete everything then create)"""
|
|
created, deleted = [], []
|
|
for perm in self._obj.permissions.all():
|
|
perm.delete()
|
|
deleted.append(perm)
|
|
self._obj.permissions.clear()
|
|
if self._permissions:
|
|
for perm in self._permissions:
|
|
op = Operation.objects.get_by_natural_key_json(perm['operation'])
|
|
ou = OrganizationalUnit.objects.get_by_natural_key_json(perm['ou']) if perm['ou'] else None
|
|
ct = ContentType.objects.get_by_natural_key_json(perm['target_ct'])
|
|
target = ct.model_class().objects.get_by_natural_key_json(perm['target'])
|
|
perm = Permission.objects.create(operation=op, ou=ou, target_ct=ct, target_id=target.pk)
|
|
self._obj.permissions.add(perm)
|
|
created.append(perm)
|
|
|
|
return created, deleted
|
|
|
|
|
|
class ImportResult:
|
|
def __init__(self):
|
|
self.roles = {'created': [], 'updated': []}
|
|
self.ous = {'created': [], 'updated': []}
|
|
self.attributes = {'created': [], 'deleted': []}
|
|
self.parentings = {'created': [], 'deleted': []}
|
|
self.permissions = {'created': [], 'deleted': []}
|
|
|
|
def update_roles(self, role, d_status):
|
|
self.roles[d_status].append(role)
|
|
|
|
def update_ous(self, ou, status):
|
|
self.ous[status].append(ou)
|
|
|
|
def _bulk_update(self, attrname, created, deleted):
|
|
attr = getattr(self, attrname)
|
|
attr['created'].extend(created)
|
|
attr['deleted'].extend(deleted)
|
|
|
|
def update_attributes(self, created, deleted):
|
|
self._bulk_update('attributes', created, deleted)
|
|
|
|
def update_parentings(self, created, deleted):
|
|
self._bulk_update('parentings', created, deleted)
|
|
|
|
def update_permissions(self, created, deleted):
|
|
self._bulk_update('permissions', created, deleted)
|
|
|
|
def to_str(self, verbose=False):
|
|
res = ""
|
|
for attr in ('roles', 'ous', 'parentings', 'permissions', 'attributes'):
|
|
data = getattr(self, attr)
|
|
for status in ('created', 'updated', 'deleted'):
|
|
if status in data:
|
|
s_data = data[status]
|
|
res += "%s %s %s\n" % (len(s_data), attr, status)
|
|
return res
|
|
|
|
|
|
def import_ou(ou_d):
|
|
OU = OrganizationalUnit
|
|
ou = search_ou(ou_d)
|
|
if ou is None:
|
|
ou = OU.objects.create(**ou_d)
|
|
status = 'created'
|
|
else:
|
|
update_model(ou, ou_d)
|
|
status = 'updated'
|
|
# Ensure admin role is created
|
|
ou.get_admin_role()
|
|
return ou, status
|
|
|
|
|
|
def import_site(json_d, import_context=None):
|
|
import_context = import_context or ImportContext()
|
|
result = ImportResult()
|
|
|
|
if not isinstance(json_d, dict):
|
|
raise ValidationError(_('Import file is invalid: not a dictionnary'))
|
|
|
|
if import_context.import_ous:
|
|
for ou_d in json_d.get('ous', []):
|
|
result.update_ous(*import_ou(ou_d))
|
|
|
|
if import_context.import_roles:
|
|
roles_ds = []
|
|
for role_d in json_d.get('roles', []):
|
|
# ignore internal roles
|
|
slug = role_d.get('slug')
|
|
if isinstance(slug, str) and slug.startswith('_'):
|
|
continue
|
|
roles_ds.append(RoleDeserializer(role_d, import_context))
|
|
|
|
for ds in roles_ds:
|
|
result.update_roles(*ds.deserialize())
|
|
|
|
if import_context.role_attributes_update:
|
|
for ds in roles_ds:
|
|
result.update_attributes(*ds.attributes())
|
|
|
|
if import_context.role_parentings_update:
|
|
for ds in roles_ds:
|
|
result.update_parentings(*ds.parentings())
|
|
|
|
if import_context.role_permissions_update:
|
|
for ds in roles_ds:
|
|
result.update_permissions(*ds.permissions())
|
|
|
|
if import_context.ou_delete_orphans:
|
|
raise ValidationError(
|
|
_("Unsupported context value for ou_delete_orphans : %s") % (import_context.ou_delete_orphans)
|
|
)
|
|
|
|
if import_context.role_delete_orphans:
|
|
# FIXME : delete each role that is in DB but not in the export
|
|
raise ValidationError(
|
|
_("Unsupported context value for role_delete_orphans : %s")
|
|
% (import_context.role_delete_orphans)
|
|
)
|
|
|
|
return result
|